ML24215A222
Text
Response to SDAA Audit Question Question Number: A-19.1-51 Receipt Date: 11/20/2023 Question:
Pages 19.1-11 and 19.2-4 of the FSAR state that with successful emergency core cooling system (ECCS) actuation, the supplemental boron (i.e., the ECCS Supplemental Boron (ESB))
function assures shutdown margin under cold conditions. In Chapter 16 of the NuScale SDA FSAR, a Limiting Condition of Operation, LCO 3.5.4, was added for the ESB. The staff reviewed the PRA ATWS report, ER-116285, Revision 1 and specifically compared the NRELAP analysis of PRA ATWS scenarios with and without credit for the ESB. The staff notes (( 2(a),(c), ECI
- 2. Since the SDA FSAR currently states the supplemental boron (i.e., the ECCS Supplemental Boron (ESB)) function assures shutdown margin under cold conditions, the staff is requesting an update to FSAR Chapter 19 summarizing the analysis in ER-116285, Revision 1. The summary should include an overview of the scenarios included and key conclusions ((
}}
2(a),(c), ECI NuScale Nonproprietary NuScale Nonproprietary
Response
- 1. Post-shutdown and re-start actions taken by control room operators, including verifying shutdown margin, will be performed according to approved plant procedures. As such, the analysis in Revision 1 of ER-116285 does not include actions that reduce shutdown margin.
- 2. NuScale revised FSAR Section 19.1 to capture the insights of the emergency core cooling system supplemental boron function from ER-116285.
Markups of the affected changes, as described in the response, are provided below: NuScale Nonproprietary NuScale Nonproprietary
NuScale Final Safety Analysis Report Probabilistic Risk Assessment NuScale US460 SDAA 19.1-11 Draft Revision 2 Core damage is defined as occurring when:
the collapsed level in the reactor has decreased such that active fuel in the core has been uncovered for a sustained period, and
a fuel peak cladding temperature (PCT) of 2200 degrees Fahrenheit or higher is reached as defined by the thermal-hydraulic calculation. Functional success criteria are then developed based on the safety functions necessary to support the overall success criterion. The functional success criteria are the minimum set of functions whose success is needed to prevent core damage and a large release. The safety functions and method of achieving the functions are summarized as follows: Audit Issue A-19.1-20 Fuel assembly heat removal: This function refers to the transfer of core heat to the UHS after a module upset. The function can be achieved by safety-related or nonsafety-related systems that can provide core cooling. Depending on the IE and accident sequence, core cooling can be achieved passively by actuation of the decay heat removal system (DHRS) or the ECCS. In the absence of these preferred, automatic methods, or actively by operator action tocan establish chemical and volume control system (CVCS) makeup inventory to the RPV or flood the CNV from the CFDS following ECCS success. Audit Issue A-19.1-51 Reactivity control: This function refers to the limiting of core power generated by the fission reaction. The function is achieved if the core is rendered subcritical by insertion of control rods as demanded by a reactor trip signal. In an anticipated transient without scram (ATWS) event, as the fuel heats up and the moderator density decreases, core power is reduced; this negative reactivity feedback maintains fuel assembly heat removal while avoiding core damage. In sequences where makeup inventory via CVCS is credited, operators initiate makeup with suction from the boron addition system (BAS), which can be used to support reactivity control. In addition, in sequences with success of ECCS, the ECCS supplemental boron (ESB) function provides negative reactivity to offset control rod insertion failures.assures shutdown under cold conditions. Containment integrity: This function refers to establishing and controlling the containment radionuclide barrier. It is achieved when sensors detect abnormal process conditions and the MPS generates a containment isolation signal for the CNTS isolation valves to close. Containment isolation supports the system success criteria for avoiding core damage by
achieving DHRS passive core cooling by closing the main steam isolation valves (MSIVs) and the feedwater isolation valves (FWIVs).
limiting the loss of primary coolant following a pipe break outside containment.
NuScale Final Safety Analysis Report Probabilistic Risk Assessment NuScale US460 SDAA 19.1-97 Draft Revision 2 Audit Issue A-19.1-51 Table 19.1-2: Design Features/Operational Strategies to Reduce Risk Design Feature Description Effect on Risk Primary cooling by natural circulation The design incorporates natural circulation cooling during almost all modes of operation (during startup circulation of the primary cooling is enhanced by using CVCS pumps).
- Absence of reactor coolant pumps means no threat of reactor coolant pump seal failures.
- No dependence of electric power or seal cooling water for primary coolant circulation and hence less likelihood of a reactor trip due to forced flow transients.
- Contributes to robust plant response during potential ATWS condition. Flow and hence heat transfer and reactivity control, is effectively self-regulated by the natural forces controlling flow through core.
Integrated primary cooling system design All components of the primary cooling system are contained inside the RPV. This includes the pressurizer, steam generators, and the primary system cooling loop.
- No external reactor cooling system pipe results in less likelihood of a pipe break outside of containment.
- Steam generator tubes that are in compression (i.e., feedwater is on the inside and coolant circulates on the outside).
Internal (to RPV) helical-coil steam generator (SG) Helical coil steam generator tubes wrap-around central riser inside the RPV. Primary coolant flows on outside of the tubes, with secondary, feedwater on inside.
- With primary, high-pressure coolant on outside of the SG tubes and the lower-pressure feedwater flow on the inside, the tubes are maintained in a constant state of compression. This is in contrast to the typical tensile stresses on the SG tubes in conventional plants. Maintaining the tubes in compression is expected to prevent crack propagation and reduce the likelihood of SG tube failure.
Passive, fail-safe ECCS The ECCS consists of valves that fail-safe on a loss of power. Heat is transferred directly to the UHS by passive natural processes (i.e., condensation, natural circulation, convection, and conduction)
- No dependence on support systems (i.e., AC or DC power, or service water) or operator action for heat transfer to the UHS.
- The ECCS is effective in maintaining core cooling for possible LOCA and pipe break sizes.
- No reliance on external sources of inventory addition to the RPV.
- The ESB function contributes to the robust plant response to ATWS events by reducing excess positive reactivity and reducing the potential for power oscillations.
Passive fail-safe DHRS Passive, natural circulation, closed-loop isolation condensers remove heat from the secondary side of the SGs.
- No electric power needed to remove heat from the secondary side of the SGs.
- Closed-loop system does not need additional inventory.
- Passive, electric-power independent response to unplanned reactor trip.
Small reactor core Reactor core in each module is a fraction of the size of a typical large PWR core.
- Small reactor core is easier to keep cool under normal and abnormal conditions.
(Passive safety systems maintain core cooling.)
- Each core, in a multiple NPM plant, is contained in a separate RPV, which in turn is contained in a separate CNV. The distribution of the total plant core material, combined with the small size of each core, enhances the ability to cool the core passively.
- Small reactor core results in relatively low heat load on the RPV lower head in the unlikely event a severe accident results in core relocation to the lower head; as a result, evaluation indicates core debris is retained in the RPV.
No RPV penetrations below top of core The RPV does not have penetrations below the refueling flange.
- No penetrations in the lower portion of the RPV means there is not a credible mechanism for draining the RPV and uncovering the core.
NuScale Final Safety Analysis Report Probabilistic Risk Assessment NuScale US460 SDAA 19.1-102 Draft Revision 2 Audit Issue A-19.1-51 Table 19.1-6: Success Criteria per Top Event Top Event Mitigating System1 Description CFDS-T01 CFDS In sequences with a continued loss of RCS inventory (e.g., unisolated pipe break) and success of ECCS, the CFDS can provide RCS makeup inventory. Actuation requires an operator action that includes unisolating containment and activating a CFDS pump (CFDS--HFE-0001C-FOP-N). CVCS-T02 CVCS isolation Following an injection line break outside of containment, closure of either CIV in the injection line isolates the line and minimizes the loss of RCS inventory. CVCS-T03 CVCS isolation Following a discharge line break outside of containment, closure of either CIV in the discharge line isolates the line and minimizes the loss of RCS inventory. CVCS-T01 CVCS makeup The CVCS can provide RCS makeup via the injection or pressurizer spray line. CVCS-T04 CVCS makeup Following a CVCS injection or spray line break inside containment, RCS makeup can be provided via the alternate line; the injection line following a spray line break, or the spray line following an injection line break. Actuation requires an operator action to unisolate containment and activate a CVCS makeup pump (CVCS--HFE-0001C-FOP-N). The BAS and the DWS provide inventory to support the PRA mission. DHRS-T01 DHRS The DHRS provides fuel assembly heat removal. The DHRS is a passive cooling system that removes fuel assembly heat by circulating coolant through the SGs and DHRS condensers that transfer heat to the UHS. One of two trains is required and each requires opening an actuation valve and closing the respective secondary system CIVs or backup valves in the MSS and the FWS. DHRS-T02 DHRS Following an SGTF, the DHRS in the unaffected SG provides fuel assembly heat removal. ECCS-T01 ECCS The ECCS provides fuel assembly heat removal and control of RCS inventory without the need for makeup inventory or containment isolation2. Success of the ECCS requires the opening of one RVV and one RRV. The system passively circulates coolant by removing heat from the reactor core through the CNV to the UHS. The main ECCS RRVs include a passive opening feature. If a valve fails to open because of a failure in the hydraulic actuator (i.e., closed trip valve or closed IAB), the valve passively opens when the spring force overcomes the differential pressure force across the valve disc3. Thermal-hydraulic simulations were performed to confirm the effectiveness of the low differential pressure opening mechanism, including the timing of opening of the valves. Only passive opening of the RRVs is credited in the PRA4. Thermal-hydraulic simulations demonstrate that the negative reactivity provided by the ESB function reduces the potential for power oscillations in ATWS scenarios, in particular at end-of-cycle conditions when reactor coolant boron concentration is low. However, the ESB function is not required to prevent core damage. Actuation signals include low RCS level, high-high RCS pressure, high-high RCS average temperature, the reactor trip 8-hour timer, and the low AC voltage 24-hour timer. Loss of two or more EDAS buses also deenergizes the solenoids to open the ECCS valves. ECCS-T02 ECCS Following an unisolated break outside containment, the opening of both RVVs and both RRVs can provide RCS heat removal and control of RCS inventory without the need for makeup inventory. An operator action to actuate the ECCS in cases where automatic initiation fails is considered (ECCS--HFE-0001C-FTO-N).}}